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This is in response to the appeal brief filed February 7 and May 15, 2007 
appealing from the Office action mailed February 7, 2006. 

(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial 
proceedings which will directly affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is incorrect. A correct 
statement of the status of the claims is as follows: 

Claims 23-44 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

Claims 23-44 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Cramer. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection 
contained in the brief is incorrect. 

The amendment after final rejection filed on 9/7/2006 has been entered. 
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(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellants statement of the grounds of rejection to be reviewed on appeal is 
incorrect. 

WITHDRAWN REJECTIONS 

The following grounds of rejection are not presented for review on appeal 
because they have been withdrawn by the examiner. 

The rejection of claims 23-44 under 35 U.S.C. 101 is withdrawn in view of 
amendment. 

The rejection of claims 25-27, 29, 31-34, 37-39, and 42-44 under 35 U.S.C. 112, 
second paragraph, because of their dependency from cancelled claims is withdrawn. 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 

6,697,488 CRAMER et al. 2-2004 
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(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 

Claim Rejections - 35 USC §112 
The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 23, 28, 35, and 40 are rejected under 35 U.S.C. 112, second paragraph, 
as being indefinite for failing to particularly point out and distinctly claim the subject 
matter which applicant regards as the invention. 

Claims 23, 28, 35, and 40 recite the limitations " ch || a 2 <q ". There is insufficient 
antecedent basis for these limitations in the claims. 

Claims 24 and 40-41 are rejected under 35 U.S.C. 112, second paragraph, as 
being indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicant regards as the invention. 

Claims 24 and 40-41 recite the limitations " ciphertext and by using the secret 
key, Oi\ a 2 \ m' where ". There is insufficient antecedent basis for these limitations in 
the claims. 

Claim 30 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

Claim 30 recites the limitation "m = D K - (C)" in page 9. There is insufficient 
antecedent basis for this limitation in the claim. 
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Claim 36 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

Claim 36 recites the limitation "transmitting ciphertext (ui, U2, v, C)" in page 13. 

There is insufficient antecedent basis for this limitation in the claim. 

Claims 28, 40-41 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

Claims 28, 40-41 recite the limitation = D S k(e)". There is insufficient 
antecedent basis for these limitations in the claims. 

Claim Rejections - 35 USC § 103 

The text of those sections of Title 35, U.S. Code not included in this action can 
be found in a prior Office action. 

Claims 23-44 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Cramer. 

Regarding claim 23, Cramer teaches a public-key cryptographic scheme 
comprising: 

- a key generation step of generating a secret-key: 

o xi , x 2 , yn , yi2 , Y2i , y 2 2 , z e Z q (column 7, lines 1-67) 

- and a public-key: 

o G, G': finite multiplicative group G c G\ 
o q: prime number and the order of G, 



Application/Control Number: 10/046,224 Page 6 

Art Unit: 2136 

o gi, g2 e G (column 6, lines 1-67, column 7, lines 1-67), 
o c= g! A xi g 2 A x 2 , g^yn g 2 A yi2, d 2 = gi A y 2 i g 2 A y 22 , h= g^z, 
o tt : Xi x X 2 x M -»■ G' : one-to-one mapping 
o tt 1 : Im(Tr) — ► Xi x X 2 x M (column 7, lines 1-67) 

- where the group G is a partial group of the group G\ Xi and X 2 are an infinite 
set of positive integers which satisfy: 

o cm || a 2 <q (for every ai € X-i , for every a 2 <= X 2 ) 

- where M is a plaintext space; 

- a ciphertext generation and transmission step of selecting random numbers 

a 2 eX 2 ,re Z q for a plaintext m (m e M), calculating: 
o Ui=gA, u 2 =g 2 A r, e=Tr(ai, a 2 , m)h r , v=gi A ai c r di A ar d 2 A mr (column 7, 
lines 1-67, column 8, lines 1-67) 

- where a = ai || a 2 and transmitting (ui, u 2 , e, v) as a ciphertext (column 8, 
lines 24-35); and 

- a ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, ch*, a 2 \ m' (aVe XV, a 2 'eX 2 , m'e M) 
which satisfy: 

o it (<n\ a 2 ', m') = e/(ui A z) (column 8, lines 36-67, column 9, lines 1-67, 

column 10, lines 1-67) and if the following is satisfied: 
o (gi A ai')(ui A (x 1 + a'yii+m'y 21 ))(u 2 A (x 2 + a'yi 2 +m'y 22 ))=v 
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- outputting m' as the deciphered results (where a' = oT || a 2 '), whereas if not 
satisfied, outputting as the decipher results the effect that the received 
ciphertext is rejected (column 9, lines 1-67, column 10, lines 1-67, column 11, 
lines 1-67). 

Cramer discloses generating a secret-key using five exponent numbers (xi, x 2 , 
yi, y 2 , z e Z q ), generating a public-key, and transmitting a cipher-text (ui, u 2 , e, v). 
Furthermore, Cramer teaches generating extended private key and public key (column 
4, lines 1 9-45) and suggests using more elements to generate the keys (Cramer, claim 
1,11, and 20). Therefore, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to generate the secret key by modifying Cramer's 
generating step. One of ordinary skill in the art would have been motivated to do so to 
increase the security of the cryptographic scheme (Cramer, column 3, lines 1-67, 
column 4, lines 1-67). 

Regarding claim 24, Cramer teaches a public-key cryptographic scheme 
comprising: 

- a key generation step of generating a secret-key: 

o xi, x 2 , yn, y 12 , y 21 , y 22 , z e Z q (column 7, lines 1-67) 

- and a public-key: 

o p, q: prime number where q is a prime factor of p-1 , 
o g-i,g 2 € Z p : ord p (gi)= ord p (g 2 ) = q (column 6, lines 1-67, column 7, 
lines 1-67) 
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o c= g/xi g 2 A x 2 mod p, di= gi A yn g 2 A yi2 mod p, d 2 = g/y 2 i g 2 A y 22 mod p, 
h= gi A z mod p, 

o ki , k 2 , k 3 : positive constant, 10 k1+k2 < q, 10 k3 < q, io k1+k2+k3 < p 
(column 7, lines 1-67) 

- where a ciphertext generation and transmission step of selecting random 
numbers a = ai || a 2 where |ai| = ki , |a 2 | = k 2 for a plaintext m where Iml = k 3 
where |x| is the number of digits of x), calculating: m = a||K 

- selecting a random number r e Z q , calculating: 

o ui= g/ mod p, u 2 = g 2 r mod p, e= m h r mod p, v=gi A ai c r d/ ar d 2 A mr 
mod p 

- and transmitting (ui, u 2 , e, v) as a ciphertext (column 8, lines 1-67); and 

- a ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, ch\ a 2 \ m' where |ai'|=ki , |a 2 '| = k 2l 
|m'|= k 3 which satisfy: 

o ai'Ha^llm' = e/(ui A z) mod p (column 8, lines 1-67, column 9, lines 1-67, 

column 10, lines 1-67) and if the following is satisfied: 
o (gi A a i , )(ui A (x 1 + a'yii+m , y2i))(u 2 A (x 2 + a'yi2+m'y22))=v (mod p) 

- outputting m' as the deciphered results, where a' = ai' || a 2 \ whereas if not 
satisfied, outputting as the decipher results the effect that the received 
ciphertext is rejected (column 9, lines 1-67, column 10, lines 1-67, column 11, 
lines 1-67). 
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Cramer discloses generating a secret-key using five exponent numbers (x^ x 2 , 
yi, y 2 , z e Z q ), generating a public-key, and transmitting a cipher-text (ui, u 2> e, v). 
Furthermore, Cramer teaches generating extended private key and public key (column 
4, lines 19-45) and suggests using more elements to generate the keys (Cramer, claim 
1,11, and 20). Therefore, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to generate the secret key by modifying Cramer's 
generating step. One of ordinary skill in the art would have been motivated to do so to 
increase the security of the cryptographic scheme (Cramer, column 3, lines 1-67, 
column 4, lines 1-67). 

Regarding claim 28, Cramer teaches a cryptographic communication method 
comprising: 

- a key generation step of generating a secret-key: 

o xi, x 2 , yn, yi 2 , y 2 i, y 22 , z e Z q (column 7, lines 1-67) 

- and a public-key: 

o G, G': finite multiplicative group G c G\ 

o q: prime number and the order of G, 

o gi,g 2 e G (column 6, lines 1-67, column 7, lines 1-67), 

o c= g 1 A x 1 g 2 A x 2 , di= gi A yn g 2 A yi 2 , d 2 = gi A y 2i g 2 A y 22 , h= gi A z, 

o tt : Xi x X 2 x M — ► G' : one-to-one mapping 

o tt" 1 : Im(TT) — ► Xi x X 2 x M (column 7, lines 1-67) 

o E : symmetric encipher function (column 12, lines 1-67) 
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- where the group G is a partial group of the group G', Xi and X 2 are an infinite 
set of positive integers which satisfy: 

o ai || a 2 <q (for every ai e Xi , for every a 2 e X 2 ) 

- where M is a key space; 

- a cipher-text generation and transmission step of selecting random numbers 
a-i e Xi , a 2 e X 2 , r e Z q for key data K (K e M), calculating: 

o Ui=gA, u 2 =g 2 A r, e=TT(ai, a 2 , K)h r , v=g-i A ai c r d/ar d 2 A Kr (column 7, 
lines 1-67, column 8, lines 1-67) 

- where a = ch || a 2 , generating a ciphertext C of transmission data m by: 

o C = Ek (m) (column 12, lines 1-35) 

- by using a symmetric cryptographic function E and key data K, and 
transmitting (m, u 2 , e, v, C as the ciphertext (column 8, lines 1-67); and 

- a ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, cm', a 2 ', K' (ai'e Xi, a 2 'eX 2 , K'e M) 
which satisfy: 

o tt (ai'|| 02*11 K') = e/(ui A z) (column 8, lines 36-67, column 9,lines 1-67, 
column 10, lines 1-67) and if the following is satisfied: 

o (g 1 A a 1 ')(ui A (xi+ a'yn+K'y 21 ))(u 2 A (x 2 + a'yi 2 +K'y 22 ))=v where a' = ai' || 
a 2 \ 

- executing a decipher process by: 

o m=D K (C) 
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- outputting deciphered results, whereas if not satisfied, outputting as the 
decipher results the effect that the received ciphertext is rejected (column 9, 
lines 1-67, column 10, lines 1-67, column 11, lines 1-67). 

Cramer discloses generating a secret-key using five exponent numbers (x-i, x 2 , 

i 

y 1f y 2 , z e Z q ), generating a public-key, and transmitting a cipher-text (ui, u 2 , e, v). 
Furthermore, Cramer teaches generating extended private key and public key (column 
4, lines 19-45) and suggests using more elements to generate the keys (Cramer, claim 
1,11, and 20). Therefore, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to generate the secret key by modifying Cramer's 
generating step. One of ordinary skill in the art would have been motivated to do so to 
increase the security of the cryptographic scheme (Cramer, column 3, lines 1-67, 
column 4, lines 1-67). 

Regarding claim 29, Cramer teaches wherein the ciphertext C is generated by: 
o C = E K (f(ai,a 2 )||m) 

- by using a symmetric cryptographic function E, the key data K and a 
publicized proper function f, it is checked whether the following is satisfied: 

0 (gi A ai')(ui A (xi+ a , yii + K , y2i))(u 2 A (x 2 + a'yi2+K'y 22 ))=v 
° f(a 1 ',a 2 , ) = [D K '(C)] K 

- where f outputs a value of k bits and [x] k indicates the upper k bits of x, and if 
the check passes, a decipher process is executed by: 

o m=[D K *(C)]- K 
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- where [x]" k indicates a bit train with the upper k bits of x being removed 
(column 8, lines 1-67, column 9, lines 1-67, column 12, lines 1-67). 

Regarding claim 30, Cramer teaches a cryptographic communication method 
comprising: 

- a key generation step of generating a secret-key: 

o xi, x 2 , yn, yi2, y2i> y22, z e Z q (column 7, lines 10-19) 

- and a public-key: 

o p, q: prime number, where q is a prime factor of p-1 , 
o gi,g 2 e Z p : ordp (gi)= ordp (g 2 ) = q (column 6, lines 1-67, column 7, 
lines 1-67) 

o c= g/xi g 2 A x 2 mod p, di= gi A yn g 2 A yi 2 mod p, d 2 = gi A y 21 g 2 A y 22 mod p, 
h= g/zmod p, 

o ki , k 2 , k 3 : positive constant 10 k1+k2 < q, 10 k3 < q, io k1+k2+k3 < p (column 
7, lines 1-67) 

o E : symmetric encipher function (column 12, lines 1-35) 

- a cipher-text generation and transmission step of selecting random numbers 
a = ai || a 2 , where |ai| = ki , |a 2 | = k 2 for key data K |K| = k3 where |x| is the 
number of digits of x), calculating 

- rii = a||K (column 7, lines 1-67, column 8, lines 1-67, column 12, lines 1-67) 

- selecting a random number r e Z q , calculating: 

o ui= g/mod p, u 2 = g 2 r mod p, e= m h r mod p, v=g/ aic r d^ard/Kr 
mod p (column 7, lines 1-67, column 8, lines 1-67) 
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- and generating a ciphertext C of transmission data by: 

o C = Ek (m) (column 12, lines 1-35) 

- by using a symmetric cryptographic function E and the key data K, and 
transmitting (ui, u 2 , e, v, C) as the ciphertext (column 8, lines 1-67); and 

- a ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, Ch', a 2 ', K', where |ai'|=ki, |a 2 '|=k 2 , 
|K'|= k 3 which satisfy: 

- ai'H a 2 '|| K* = e/(ui A z) mod p (column 8, lines 36-67, column 9, lines 1-67, 
column 10, lines 1-67) 

- and if the following is satisfied: 

- (gi A a i ')(u 1 A (x 1 + a'yn+K'y 2 i))(u 2 A (x 2 + a'yi 2 +K'y 22 ))=v (mod p) 

- where a' = a/ || a 2 ', 

- executing a decipher process by: 

o m=D K ( C) 

- outputting deciphered results, whereas if not satisfied, outputting as the 
decipher results the effect that the received ciphertext is rejected (column 9, 
lines 1-67, column 10, lines 1-67, column 11, lines 1-67). 

Cramer discloses generating a secret-key using five exponent numbers (xi, x 2 , 
yi, y 2 , z e Z q ), generating a public-key, and transmitting a cipher-text (ui, u 2 , e, v). 
Furthermore, Cramer teaches generating extended private key and public key (column 
4, lines 19-45) and suggests using more elements to generate the keys (Cramer, claim 
1,11, and 20). Therefore, it would have been obvious to one having ordinary skill in the 
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art at the time the invention was made to generate the secret key by modifying Cramer's 
generating step. One of ordinary skill in the art would have been motivated to do so to 
increase the security of the cryptographic scheme (Cramer, column 3, lines 1-67, 
column 4, lines 1-67). 

Regarding claim 31, Cramer teaches wherein the ciphertext C is generated by: 

- C = E K (f(ai,a 2 )||m) 

- by using a symmetric cryptographic function E, the key data K and a 
publicized proper function f, it is checked whether the following is satisfied: 

0 (gi A ai , )(ui A (xi+ a , yii+K , y2i))(u 2 A (x 2 + 0^12+^22)) =v (mod p), 
o f(a 1 ',a 2 , ) = [D K <C)] k 

- where f outputs a value of k bits and [x] k indicates the upper k bits of x, and if 
the check passes, a decipher process is executed by: 

- m=[D K '(C)]- K 

- where [x]~ k indicates a bit train with the upper k bits of x being removed 
(column 8, lines 1-67, column 9, lines 1-67, column 12, lines 1-67). 

Regarding claim 35, Cramer teaches a cryptographic communication method 
comprising: 

- a key generation step of generating a secret-key: 

o x-i, x 2 , yi, y2, 2 g Z q (column 7, lines 1-67) 

- and a public-key: 

o G, G': finite multiplicative group G e G\ 
o q: prime number the order of G, 
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o gi,g2 e G (column 6, lines 1-67, column 7, lines 1-67), 
o c= gi A xi g 2 A x 2 , d = gi A yi g 2 A y2, h= gi z , 

o u : X-i x X 2 x M — ► Dom(E) : one-to-one mapping where Dom(E) is the 

domain of the function E 
o if 1 : Im(TT) Xi x X 2 x M (column 7, lines 1-67) 
o H : hash function (column 12, lines 1-35) 
o E : symmetric encipher function (column 12, lines 1-35) 

- where the group G is a partial group of the group G\ Xi and X 2 are an infinite 
set of positive integers which satisfy: 

o Ch || a 2 <q (for every cm e Xi , for every a 2 e X 2 ) 

- a cipher-text generation and transmission step of selecting random numbers 
ai e X-i ( a 2 e X 2 , r e Z q , calculating: 

o ui=gi r , u 2 =g 2 r , v=gi A cm c r d ar , K = H(h r ) (column 7, lines 1-67, column 
8, lines 1-67) 

- where a = ai || a 2 , generating a ciphertext C of transmission data m by: 

o C = E K (TT(ai, a 2 , m)) (column 12, lines 1-35) 

- by using a symmetric cryptographic function E; and transmitting (m, u 2 , v, C) 
as the ciphertext (column 8, lines 24-35); and 

- a ciphertext reception and decipher step of calculating 

o K' = H(ui z ) 
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- by using the secret key, calculating from the received ciphertext, aV, a 2 \ 
(where a^e X<|, a 2 'eX 2 ) (column 8, lines 36-67, column 9,lines 1-67, column 
10, lines 1-67) which satisfy: 

o 7i(ai\ a 2 \ m') = D K ( C ) 

- if the following is satisfied: 

o (gi A ai')(ui A (xi+ a , yi))(u 2 A (x 2 + a'y2))=v, 

- where a' = a<T || a 2 ', 

- outputting m' as the deciphered results, whereas if not satisfied, outputting as 
the decipher results the effect that the received cipher- text is rejected 
(column 9, lines 1-67, column 10, lines 1-67, column 11, lines 1-67). 

Cramer discloses generating a secret-key using five exponent numbers (x 1f x 2 , 
yi, y 2 , z e Z q ), generating a public-key, and transmitting a cipher-text (ui, u 2 , e, v). 
Furthermore, Cramer teaches generating extended private key and public key (column 
4, lines 19-45) and suggests using more elements to generate the keys (Cramer, claim 
1,11, and 20). Therefore, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to generate the secret key by modifying Cramer's 
generating step. One of ordinary skill in the art would have been motivated to do so to 
increase the security of the cryptographic scheme (Cramer, column 3, lines 1-67, 
column 4, lines 1-67). 

Regarding claim 36, Cramer teaches a cryptographic communication method 
comprising: 

- a key generation step of generating a secret-key: 
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o Xl x 2 , yi, y 2 , z e Z q (column 7, lines 1-67) 

- and a public-key: 

o p, q: prime number (q is a prime factor of p-1 ), 
o gi,g2 e Z p : ordp (gi)= ord p (g 2 ) = q (column 6, lines 1-67, column 7, 
lines 1-67) 

o c= g/xi g 2 A x 2 mod p, d= g/y! g 2 A y 2 mod p, h= mod p, 

o ki , k 2 , k 3 : positive constant 10 k1+k2 < q, 10 k3 < q, io k1+k2+k3 < p (column 

7, lines 1-67) 
o H : hash function (column 12, lines 1-35) 

o E : symmetric encipher function where the domain of E is all positive 
integers (column 12, lines 1-35) 

- a cipher-text generation and transmission step of selecting random numbers 
a = ai || a2 , where |a-i| = ki , |a 2 | = k 2 , where |x| is the number of digits of x, 

- selecting a random number r e Z q , calculating: 

o Ui= g/ mod p, u 2 = g 2 r mod p, v=gi A ai c r d ar mod p, K = H(h r mod p) 

- transmitting ciphertext (ui, u 2 , v, C) (column 8, lines 1-67) 

- generating a ciphertext C of transmission data m by: 

o C = E K (ai||a 2 ||m) (column 12, lines 1-35) 

- by using a symmetric cryptographic function, and transmitting (ui, u 2 , v, C) as 
the ciphertext (column 8, lines 1-67) 

- a ciphertext reception and decipher step of calculating 

o K' = H(u-i 2 mod p) 
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- by using the secret key, calculating from the received ciphertext, ai', 02', 
where |ai'|=ki , |a 2 '| = k 2 which satisfy: 

o ai'Haz'llm' = D K ( C ) 

- and if the following is satisfied: 

o (gi A ai')(ui A (x 1 + a'yi))(u 2 A (x 2 + a'y2))=v (mod p) 

- outputting m' as the deciphered results where a' = aV || a 2 ', whereas if not - 
satisfied, outputting as the decipher results the effect that the received 
ciphertext is rejected (column 9, lines 1-67, column 10, lines 1-67, column 11, 
lines 1-67). 

Cramer discloses generating a secret-key using five exponent numbers (x 1f x 2 , 
yi, y 2 , z € Z q ), generating a public-key, and transmitting a cipher-text (ui, u 2 , e, v). 
Furthermore, Cramer teaches generating extended private key and public key (column 
4, lines 19-45) and suggests using more elements to generate the keys (Cramer, claim 
1,11, and 20). Therefore, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to generate the secret key by modifying Cramer's 
generating step. One of ordinary skill in the art would have been motivated to do so to 
increase the security of the cryptographic scheme (Cramer, column 3, lines 1-67, 
column 4, lines 1-67). 

Regarding claim 40, Cramer teaches a cryptographic communication method 
comprising: 

- a key generation step of generating a secret-key: 

o X1, x 2 , yi, y 2 g Z q (column 7, lines 1-67) 
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o sk : asymmetric cryptography decipher key (column 7, lines 1-67) 

- and a public-key: 

o G : finite multiplicative group 

o q: prime number and the order of G, 

o gi,g2 e G (column 6, lines 65-67, column 7, lines 1-10) 

o c= g/xi g 2 A x 2 , d= gi A yi g 2 A y2, 

o tt : Xi x X 2 x M -> Dom (E) : one-to-one mapping where Dom (E) is the 

domain of the function E 
o tt" 1 : lm(ir) — ► Xi x X 2 x M (column 7, lines 1-67) 
o E pk (.) : Encipher function for asymmetric cryptography (column 12, 

lines 1-35) 

- where X<| and X 2 are an infinite set of positive integers which satisfy: 

o oh || a 2 <q (for every cm € Xi ( for every a 2 e X 2 ) 

- where M is a plaintext space; 

- a cipher-text generation and transmission step of selecting random numbers 
cm e Xi f a 2 e X 2 , r e Z q , calculating: 

o ui=g/, u 2 =g 2 r , v=gi A cm c r d ar (column 7, lines 1-67, column 8, lines 1- 
67) 

where a = cm || a 2 , generating a ciphertext C of transmission data m by: 
o e = E pk (7c(ai,a 2 ,m)) (column 12, lines 1-35) 

- by using an encipher function for asymmetric cryptographic E pk , and 
transmitting (ui, u 2 , e, v) as the ciphertext (column 8, lines 24-35); and 
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- a ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, cm', a 2 ', m\ where aYe Xi, a 2 '<=X 2 , 
m'e M which satisfy: 

o "ft (ai*. a 2 ', m') = D S k(e) (column 8, lines 36-67, column 9, lines 1-67, 
column 10, lines 1-67) 

- and if the following is satisfied: 

o (gi A ai')(ui A (xi+ a'yi))(u 2 A (x 2 + a*y 2 ))=v 

- where: 

o a' = ai'||a 2 ' 

- outputting m' as the deciphered results, whereas if not satisfied, outputting as 
the decipher results the effect that the received ciphertext is rejected (column 
9, lines 1-67, column 10, lines 1-67, column 11, lines 1-67). 

Cramer discloses generating a secret-key using five exponent numbers (xi, x 2 , 
y-i, y 2 , z e Z q ), generating a public-key, and transmitting a cipher-text (u-i, u 2 , e, v). 
Furthermore, Cramer teaches generating extended private key and public key (column 
4, lines 19-45) and suggests using more elements to generate the keys (Cramer, claim 
1,11, and 20). Therefore, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to generate the secret key by modifying Cramer's 
generating step. One of ordinary skill in the art would have been motivated to do so to 
increase the security of the cryptographic scheme (Cramer, column 3, lines 1-67, 
column 4, lines 1-67). 
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Regarding claim 41, Cramer teaches a cryptographic communication method 
comprising: 

- a key generation step of generating a secret-key: 

o xi, x 2 , yi, y2 e Z q (column 7, lines 1-67) 

o sk : asymmetric cryptography decipher key (column 7, lines 1-67) 

- and a public-key: 

o p, q: prime number where q is a prime factor of p-1 
o gi,g 2 e Z p : ord p (gi)= ord p (g 2 ) = q (column 6, lines 1-67, column 7, 
lines 1-67) 

o c= gi A X! g 2 A x 2 mod p, d= gi A yi g 2 A y 2 mod p, 
o ki , k 2 : positive constant io k1+k2 < q 

o Ep k (.) : encipher function for asymmetric cryptography where the 
domain is all positive integers) (column 12, lines 1-35) 

- a cipher-text generation and transmission step of selecting random numbers 
a = ai || a 2 , where |ai| = ki , |a 2 | = k 2 where |x| is the number of digits of x, 
selecting a random number r e Z q> calculating: 

o Ui= g/ mod p, u 2 = g 2 r mod p, v=g! A eh c r d ar mod p 

- generating a ciphertext C of transmission data m (positive integer) by: 

o e = Ep k (ai||a 2 ||m) (column 12, lines 1-35) 
by using the secret key, and transmitting (ui, u 2 , e, v) as the ciphertext 
(column 8, lines 1-67); and 
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- a ciphertext reception and decipher step of calculating from the received 
ciphertext and by using the secret key, ch\ a 2 \ m' where |ai'|=k 1( |a 2 '|=k 2 , rrV 
is a positive integer which satisfy: 

o Oi'H a 2 '|| m' = Dsk(e) (column 8, lines 36-67, column 9, lines 1-67, 
column 10, lines 1-67) 

- and if the following is satisfied: 

o (gi A ai , )(ui A (x 1 + a'yi))(u 2 A (x 2 + a'y2))=v (mod p), 

- where 

o a' = ai' || a 2 

- outputting m' as the deciphered results, whereas if not satisfied, outputting as 
the decipher results the effect that the received ciphertext is rejected (column 
9, lines 1-67, column 10, lines 1-67, column 11, lines 1-67). 

Cramer discloses generating a secret-key using five exponent numbers (xi, x 2 , 
yi, y 2 , z e Z q ), generating a public-key, and transmitting a cipher-text (ui, u 2 ; e, v). 
Furthermore, Cramer teaches generating extended private key and public key (column 
4, lines 19-45) and suggests using more elements to generate the keys (Cramer, claim 
1,11, and 20). Therefore, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to generate the secret key by modifying Cramer's 
generating step. One of ordinary skill in the art would have been motivated to do so to 
increase the security of the cryptographic scheme (Cramer, column 3, lines 1-67, 
column 4, lines 1-67). 
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Regarding claims 25, 32, 37, and 42, Cramer teaches wherein the public-key is 
generated by a receiver and is made public (columns 1-3). 

Regarding claims 26 and 33, Cramer teaches wherein in said ciphertext 
transmission step, the random numbers cheXi, a 2 eX 2 , and reZ q are selected 
beforehand and the following is calculated and stored beforehand: Ui=g/, u 2 =g 2 r , h r , 
gi A ch c r di A ar (column 7, lines 1-67, column 8, lines 1-67). 

Regarding claims 27 and 34, Cramer teaches wherein in said ciphertext 
transmission step, the random numbers ch, a 2 where |a<i|= ki , |a 2 |= k 2 , and r<=Z q are 
selected beforehand and the following is calculated and stored beforehand: Ui=gi r mod 
p. u 2 =g 2 r mod p, h r mod p, gi A ch c r di A ar mod p (column 7, lines 40-67, column 8, lines 1- 
22). 

Regarding claims 38 and 43, Cramer teaches wherein in said ciphertext 
transmission step, the random numbers ch , a 2 , where aieXi, a 2 eX 2 and reZ q are 
selected beforehand and the ui, u 2 , e, and v (ui, u 2 , and v ) are calculated and stored 
beforehand (column 7, lines 40-67, column 8, lines 1-22). 

Regarding claims 39 and 44, Cramer teaches wherein in said ciphertext transmission 
step, the random numbers ai , a 2 (|ai|= ki, |a 2 | = k 2 ), and reZ q are selected beforehand 
and the m, u 2 , e, and v (ui, u 2l and v ) are calculated and stored beforehand (column 7, 
lines 40-67, column 8, lines 1-22). 
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(10) Response to Argument 

A. 35 USC §112, second paragraph rejection of claim 25-27, 29, 31-34, 37-39 
and 42-44 

Regarding the remaining claims (independent claims 23, 24, 28, 30, 35, 36, 40 
and 41) Appellant has failed to address the insufficient antecedent basis issues raised 
on the previous office action, i.e. the independent claims list a number of elements that 
are not defined and are not properly tied to the body of the claim, rendering the claims 
indefinite. Claim 23's limitation of satisfying "ai || 02<q" is indefinite because there is 
insufficient antecedent basis, the elements are not defined, it is not clear how those 
elements are generated or obtained and / or what they are intended to be, thus the 
metes and bounds of the claim are not definite. Claims 23, 24, 28, 30, 35, 36, 40 and 41 
recite the limitations "a key generation step of generating a secret-key:" and a 
public-key:" with a list of undefined elements in between without a relation of how are 
they being used to generate a key or how are they obtained/selected. The relationship 
between the elements listed and how they are used to produce a key is not clear, i.e. 
claim 23 states "a key generation step of generating a secret-key: Xi , x 2 , yn , yi2 , y2i , 
y 2 2 , z e Z q and a public-key: G, G': finite multiplicative group G c G', q: prime number 
and the order of G, g it g 2 e G, c= g 2 A x 2 , di= gi A yn g 2 A y i2 , d 2 = gi A y 2 i g2 A y22, h= 
gi A z, tt : Xi x X 2 x M -> G' : one-to-one mapping, tt" 1 : Im(Tr) -► Xi x X 2 x M", the metes 
and bounds of patent protection being sought is not clearly defined. Appellant's 
arguments are not persuasive. Examiner contrasts the language found in the instant 
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application with the language found in the prior art's claims, where the variables are 
clearly defined. A clear definition of the variables would overcome this 112 rejection. 

Similar argument applies to the remaining independent claims. 

C.35 USC §1 03(a) rejection of claims 23-44 

In response to Appellant's argument that the references fail to show certain 
features of applicant's invention, it is noted that the features upon which applicant relies 
(i.e., hash function or hash value not being used, the elements are not defined, thus the 
elements are broadly interpreted as values/numbers, a hash value being of a narrower 
nature - page 18 of the Appeal Brief) are not recited in the rejected claim(s). Although 
the claims are interpreted in light of the specification, limitations from the specification 
(namely, that the values are not hash values or hash functions) are not read into the 
claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). Even 
if a hash value or hash function were not used and claimed, Cramer teaches that the 
use of a hash function can be omitted (col. 9, lines 60-67). Appellant's arguments are not 
persuasive. 

Regarding Appellant's argument that the instant application uses 2 more 
elements than Cramer, such argument is not persuasive since Cramer expressly claims 
"choosing at least a first, second, and third..." (Cramer, claim 1) which clearly 
suggests using more elements that the ones disclosed, since Cramer already 
recognizes the benefits and drawbacks of heavier computations in the calculation of the 
keys, i.e. heavier computations would make it more difficult for an unauthorized entity to 



Application/Control Number: 10/046,224 Page 26 

Art Unit: 2136 

access encrypted data while lighter computations would be faster to compute (Cramer, 
col. 1 , lines 40-60). Appellant's arguments are not persuasive. 

Regarding Appellant's argument that Cramer does not teach "d1" and "d2" 
(pages 20-21), Examiner respectfully submits that Cramer teaches "d" (Cramer, section 
V, column 9), thus "d " can change and varies. Appellant's arguments are not 
persuasive. 

In response to Appellant's argument that the references fail to show certain 
features of applicant's invention, it is noted that the features upon which applicant relies 
(i.e., k is 2 and kept small - page 22 of the Appeal Brief) are not recited in the rejected 
claim(s). Although the claims are interpreted in light of the specification, limitations from 
the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1 181 , 26 
USPQ2d 1057 (Fed. Cir. 1993). Appellant's arguments are not persuasive. 

/. Independent Claim 23 

Regarding Appellant's argument that the instant application uses 2 more 
elements than Cramer, such argument is not persuasive since Cramer expressly claims 
"choosing at least a first, second, and third..." (Cramer, claim 1) which clearly 
suggests using more elements that the ones disclosed, since Cramer already 
recognizes the benefits and drawbacks of heavier computations in the calculation of the 
keys, i.e. heavier computations would make it more difficult for an unauthorized entity to 
access encrypted data (Cramer, col. 1 , lines 40-60). Appellant's arguments are not 
persuasive. 
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Regarding Appellant's argument that Cramer does not disclose a specific 
calculation (page 25), Examiner respectfully submits that Cramer expressly claims and 
teaches performing calculations with the specific elements to obtain keys and decrypted 
data (claims 1 and 1 1 , col. 1 1 , lines 43-60), adding / subtracting / raising to the power / 
or performing a mod operation without clearly defining what the numbers are do not 
patentably distinguish the instant application form the prior art (Cramer). Appellant's 
arguments are not persuasive. 

In response to applicant's argument that the examiner's conclusion of 
obviousness is based upon improper hindsight reasoning, it must be recognized that 
any judgment on obviousness is in a sense necessarily a reconstruction based upon 
hindsight reasoning. But so long as it takes into" account only knowledge which was 
within the level of ordinary skill at the time the claimed invention was made, and does 
not include knowledge gleaned only from the applicant's disclosure, such a 
reconstruction is proper. See In re McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 
1971). 

ii. Independent Claim 24 

Regarding Appellant's argument that the instant application uses 2 more 
elements than Cramer, such argument is not persuasive since Cramer expressly claims 
"choosing at least a first, second, and third..." (Cramer, claim 1) which clearly 
suggests using more elements that the ones disclosed, since Cramer already 
recognizes the benefits and drawbacks of heavier computations in the calculation of the 
keys, i.e. heavier computations would make it more difficult for an unauthorized entity to 
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access encrypted data (Cramer, col. 1, lines 40-60). Appellants arguments are not 
persuasive. 

///. Independent Claim 28 

Regarding Appellant's argument that the instant application uses 2 more 
elements than Cramer, such argument is not persuasive since Cramer expressly claims 
"choosing at least a first, second, and third..." (Cramer, claim 1) which clearly 
suggests using more elements that the ones disclosed, since Cramer already 
recognizes the benefits and drawbacks of heavier computations in the calculation of the 
keys, i.e. heavier computations would make it more difficult for an unauthorized entity to 
access encrypted data (Cramer, col. 1, lines 40-60). Appellant's arguments are not 
persuasive. 

In response to applicant's argument that the examinees conclusion of 
obviousness is based upon improper hindsight reasoning, it must be recognized that 
any judgment on obviousness is in a sense necessarily a reconstruction based upon 
hindsight reasoning. But so long as it takes into account only knowledge which was 
within the level of ordinary skill at the time the claimed invention was made, and does 
not include knowledge gleaned only from the applicant's disclosure, such a 
reconstruction is proper. See In re McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 
1971). 

Contrary to Appellant's assertion that Cramer teaches away from adding 
additional elements, Examiner respectfully points Appellant's attention to Cramer's 
claims 1,11, and 20, where the use of more elements is suggested ("choosing at 
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least", contrast such language with "choosing at most", where it would be limiting to 
some predetermined number of elements). Appellants arguments are not persuasive. 
iV. Independent Claim 30 

Regarding Appellant's argument that the instant application uses 2 more 
elements than Cramer, such argument is not persuasive since Cramer expressly claims 
"choosing at least a first, second, and third..." (Cramer, claim 1) which clearly 
suggests using more elements that the ones disclosed, since Cramer already 
recognizes the benefits and drawbacks of heavier computations in the calculation of the 
keys, i.e. heavier computations would make it more difficult for an unauthorized entity to 
access encrypted data (Cramer, col. 1, lines 40-60). Appellant's arguments are not 
persuasive. 

In response to applicant's argument that the examiner's conclusion of 
obviousness is based upon improper hindsight reasoning, it must be recognized that 
any judgment on obviousness is in a sense necessarily a reconstruction based upon 
hindsight reasoning. But so long as it takes into account only knowledge which was 
within the level of ordinary skill at the time the claimed invention was made, and does 
not include knowledge gleaned only from the applicant's disclosure, such a 
reconstruction is proper. See In re McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 
1971). 

Contrary to Appellant's assertion that Cramer teaches away from adding 
additional elements, Examiner respectfully points Appellant's attention to Cramer's 
claims 1,11, and 20, where the use of more elements is suggested ("choosing at 
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least", contrast such language with "choosing at most", where it would be limiting to 
some predetermined number of elements). Appellant's arguments are not persuasive. 
v. Independent Claim 35 

Regarding Appellant's argument that Cramer does not expressly teach "v=g 1 A ai 
c r d ar , K = H(h r )", Examiner respectfully submits that Cramer provides the teachings of 
using a hash function and generating a verification value by means other than modular 
arithmetic (col. 7, lines 60-67, col. 8, lines 1-10), and using a broad but reasonable 
interpretation of the claim limitations, Cramer discloses on column 12 generating K as a 
value of a hash function is disclosed (Cramer, col. 12, lines 13-27). Appellant's 
arguments are not persuasive. 

Regarding Appellant's argument that Cramer does not calculate K, Examiner 
respectfully submits that as loosely defined, K, can be interpreted as a hash value, 
which Appellant has already admitted Cramer uses (Appeal Brief, pages 20-21). 

In response to Appellant's argument that the references fail to show certain 
features of applicant's invention, it is noted that the features upon which applicant relies 
(i.e., hash function or hash value not being used, the assumptions based upon - page 
18 of the Appeal Brief) are not recited in the rejected claim(s). Although the claims are 
interpreted in light of the specification, limitations from the specification are not read into 
the claims. See In re Van Geuns, 988 F.2d 1 181 , 26 USPQ2d 1057 (Fed. Cir. 1993). 
Even if a hash value or hash function were not used and claimed, Cramer teaches that 
the use of a hash function can be omitted (col. 9, lines 60-67). Appellant's arguments are 
not persuasive. 
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vi. Independent Claim 36 

Regarding Appellant's argument that the instant application uses 2 more 
elements than Cramer, such argument is not persuasive since Cramer expressly claims 
"choosing at least a first, second, and third..." (Cramer, claim 1) which clearly 
suggests using more elements that the ones disclosed, since Cramer already 
recognizes the benefits and drawbacks of heavier computations in the calculation of the 
keys, i.e. heavier computations would make it more difficult for an unauthorized entity to 
access encrypted data (Cramer, col. 1 , lines 40-60). Appellant's arguments are not 
persuasive. 

Regarding Appellant's argument that Cramer does not disclose a specific 
calculation (page 49), Examiner respectfully submits that Cramer expressly claims and 
teaches performing calculations with the specific elements to obtain keys and decrypted 
data (claims 1 and 1 1 , col. 1 1 , lines 43-60), adding / subtracting / raising to the power / 
hash function / or performing a mod operation without clearly defining what the numbers 
are do not patentably distinguish the instant application form the prior art (Cramer). 
Appellant's arguments are not persuasive. 

Regarding Appellant's argument that Cramer does not calculate K, Examiner 
respectfully submits that as loosely defined, K, can be interpreted as a hash value, 
which Appellant has already admitted Cramer uses (Appeal Brief, pages 20-21). 

vii. Independent Claim 40 

Regarding claim 40, Cramer teaches a verification cipher-number v to be used to 
verify the encrypted value (col. 7, lines 60-67, col. 8, lines 1-22). Appellant's arguments 
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are not persuasive. Regarding Appellants argument that Cramer does not expressly 
teach "transmitting (m, u 2 , e, v)", Examiner respectfully submits that Cramer provides' 
the teachings of using module arithmetic to generate the verification value (col. 7, lines 
60-67, col. 8, lines 1-10), and using a broad but reasonable interpretation meets the 
claim limitations. Appellant's arguments are not persuasive. 

Contrary to Appellant's arguments, Cramer in fact transmits (ui, U2, e, v) (col. 11, 
lines 40-60). Appellant's arguments are not persuasive. 

vllL Independent Claim 41 

Regarding Appellant's argument that the instant application uses 2 more 
elements than Cramer, such argument is not persuasive since Cramer expressly claims 
"choosing at least a first, second, and third..." (Cramer, claim 1) which clearly 
suggests using more elements that the ones disclosed, since Cramer already 
recognizes the benefits and drawbacks of heavier computations in the calculation of the 
keys, i.e. heavier computations would make it more difficult for an unauthorized entity to 
access encrypted data (Cramer, col. 1, lines 40-60). Appellant's arguments are not 
persuasive. 

Regarding Appellant's argument that Cramer does not expressly teach V=gi A cm 
c r d ar mod p", Examiner respectfully submits that Cramer provides the teachings of 
using module arithmetic to generate the verification value (col. 7, lines 60-67, col. 8, 
lines 1-10), and using a broad but reasonable interpretation meets the claim limitations. 
Appellant's arguments are not persuasive. 
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(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the 
Related Appeals and Interferences section of this examiner's answer. 

For the above reasons, it is believed that the rejections should be sustained. 
Respectfully submitted, r Ui^f 




GILBERTO BARRON Z0- 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 



Conferees: 



Gilberto Barron, SPE 




Benjamin Lanier 




